netdev - Re: [PATCH v2 bpf-next 2/2] bpf: Test ref release issue in bpf_tcp_sock and bpf_sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 2 Mar 2019 00:49:13 +0000
From:   Song Liu <songliubraving@...com>
To:     Martin Lau <kafai@...com>
CC:     Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <Kernel-team@...com>,
        Lorenz Bauer <lmb@...udflare.com>
Subject: Re: [PATCH v2 bpf-next 2/2] bpf: Test ref release issue in
 bpf_tcp_sock and bpf_sk_fullsock.



> On Mar 1, 2019, at 11:49 AM, Martin KaFai Lau <kafai@...com> wrote:
> 
> Adding verifier tests to ensure the ptr returned from
> bpf_tcp_sock() and bpf_sk_fullsock() cannot be accessed
> after bpf_sk_release() is called.  It is derived from a
> reproducer test from Lorenz Bauer.
> 
> Cc: Lorenz Bauer <lmb@...udflare.com>
> Signed-off-by: Martin KaFai Lau <kafai@...com>

Acked-by: Song Liu <songliubraving@...com>

> ---
> .../selftests/bpf/verifier/ref_tracking.c     | 73 +++++++++++++++++++
> 1 file changed, 73 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> index 3ed3593bd8b6..9695f8e9b58b 100644
> --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c
> +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> @@ -605,3 +605,76 @@
> 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
> 	.result = ACCEPT,
> },
> +{
> +	"reference tracking: use ptr from bpf_tcp_sock() after release",
> +	.insns = {
> +	BPF_SK_LOOKUP,
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> +	BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_tcp_sock, snd_cwnd)),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
> +	.result = REJECT,
> +	.errstr = "invalid mem access",
> +},
> +{
> +	"reference tracking: use ptr from bpf_sk_fullsock() after release",
> +	.insns = {
> +	BPF_SK_LOOKUP,
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
> +	.result = REJECT,
> +	.errstr = "invalid mem access",
> +},
> +{
> +	"reference tracking: use ptr from bpf_sk_fullsock(tp) after release",
> +	.insns = {
> +	BPF_SK_LOOKUP,
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> +	BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_EXIT_INSN(),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
> +	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> +	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> +	BPF_EMIT_CALL(BPF_FUNC_sk_release),
> +	BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1),
> +	BPF_EXIT_INSN(),
> +	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct bpf_sock, type)),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
> +	.result = REJECT,
> +	.errstr = "invalid mem access",
> +},
> -- 
> 2.17.1
>